Joseph Doherty
cf3bd52f93
Two-node keep-oldest could NEVER survive a crash of the oldest/active node:
Akka.NET 1.5.62 KeepOldest.OldestDecision only lets down-if-alone rescue a
side with >= 2 members, so the 1-vs-1 survivor takes DownReachable and downs
ITSELF — proven live on the rig ('SBR took decision ... including myself')
before this change. static-quorum(1) is worse (IsTooManyMembers -> DownAll);
keep-majority just re-keys the fatal crash to the lowest address.
SplitBrainResolverStrategy gains 'auto-down' (new default): BuildHocon emits
Akka's AutoDowning provider with auto-down-unreachable-after = StableAfter.
The leader among the REACHABLE members downs the unreachable peer, so the
survivor takes over singletons and /health/active in ~25s regardless of which
node died. Accepted trade (explicit owner decision): a real network partition
runs dual-active until an operator restarts one side. keep-oldest remains
supported; DownIfAlone validation is now scoped to it.
Live drill on the rebuilt rig: active-crash TAKEOVER in 28s (victim still
down; all 7 singletons Younger->Oldest), standby-crash removal 27s with 0
routing blips; victims rejoin as standby in 2s. New real-cluster tests pin
both directions (SbrFailoverTests.AutoDown_*); TwoNodeClusterFixture gains a
strategy knob. All 16 appsettings flipped (src, docker, docker-env2, and the
gitignored wonder-app-vd03 overlay on disk — owner must sync to the host).
Docs: decision record docs/plans/2026-07-21-auto-down-availability-decision.md,
Component-ClusterInfrastructure downing section rewritten, drill + README
reworked (active mode now asserts takeover), deferred-work SBR row resolved.
81 lines
3.5 KiB
C#
81 lines
3.5 KiB
C#
namespace ZB.MOM.WW.ScadaBridge.ClusterInfrastructure.Tests;
|
|
|
|
/// <summary>
|
|
/// Tests for ClusterOptions default values and property setters.
|
|
/// </summary>
|
|
public class ClusterOptionsTests
|
|
{
|
|
[Fact]
|
|
public void DefaultValues_AreCorrect()
|
|
{
|
|
var options = new ClusterOptions();
|
|
|
|
// 'auto-down' is the default posture (decision 2026-07-21): a crash of either
|
|
// node fails over to the survivor; dual-active during a real partition is the
|
|
// accepted trade for pairs with no shared lease infrastructure.
|
|
Assert.Equal("auto-down", options.SplitBrainResolverStrategy);
|
|
Assert.Equal(TimeSpan.FromSeconds(15), options.StableAfter);
|
|
Assert.Equal(TimeSpan.FromSeconds(2), options.HeartbeatInterval);
|
|
Assert.Equal(TimeSpan.FromSeconds(10), options.FailureDetectionThreshold);
|
|
Assert.Equal(1, options.MinNrOfMembers);
|
|
Assert.True(options.DownIfAlone);
|
|
}
|
|
|
|
[Fact]
|
|
public void DownIfAlone_CanBeSet()
|
|
{
|
|
var options = new ClusterOptions { DownIfAlone = false };
|
|
|
|
Assert.False(options.DownIfAlone);
|
|
}
|
|
|
|
[Fact]
|
|
public void SeedNodes_DefaultsToEmptyList()
|
|
{
|
|
var options = new ClusterOptions();
|
|
|
|
Assert.NotNull(options.SeedNodes);
|
|
Assert.Empty(options.SeedNodes);
|
|
}
|
|
|
|
// ClusterInfra-011: SectionName constant deleted — the previous test
|
|
// `SectionName_IsTheExpectedAppSettingsSection` is removed alongside it.
|
|
// The Host's SiteServiceRegistration / StartupValidator continue to
|
|
// reference the `"ScadaBridge:Cluster"` literal directly; reinstating the
|
|
// constant should happen when those Host binding sites can be updated in
|
|
// the same change.
|
|
|
|
[Fact]
|
|
public void Properties_CanBeSetToCustomValues()
|
|
{
|
|
// ClusterInfra-013: this test exercises the POCO property setters only —
|
|
// `SplitBrainResolverStrategy = "keep-majority"` and `MinNrOfMembers = 2`
|
|
// are values the design doc explicitly forbids in production
|
|
// (`keep-majority` causes total shutdown on a two-node partition;
|
|
// `MinNrOfMembers = 2` blocks the cluster singleton after failover).
|
|
// The POCO accepts any value by design; rejection lives in
|
|
// `ClusterOptionsValidator` and is covered by
|
|
// `ClusterOptionsValidatorTests.UnsupportedSplitBrainStrategy_FailsValidation`
|
|
// and `ClusterOptionsValidatorTests.MinNrOfMembers_NotOne_FailsValidation`.
|
|
// Do NOT read these values as endorsed runtime configuration.
|
|
var options = new ClusterOptions
|
|
{
|
|
SeedNodes = new List<string> { "akka.tcp://system@node1:2551", "akka.tcp://system@node2:2551" },
|
|
SplitBrainResolverStrategy = "keep-majority",
|
|
StableAfter = TimeSpan.FromSeconds(30),
|
|
HeartbeatInterval = TimeSpan.FromSeconds(5),
|
|
FailureDetectionThreshold = TimeSpan.FromSeconds(20),
|
|
MinNrOfMembers = 2
|
|
};
|
|
|
|
Assert.Equal(2, options.SeedNodes.Count);
|
|
Assert.Contains("akka.tcp://system@node1:2551", options.SeedNodes);
|
|
Assert.Contains("akka.tcp://system@node2:2551", options.SeedNodes);
|
|
Assert.Equal("keep-majority", options.SplitBrainResolverStrategy);
|
|
Assert.Equal(TimeSpan.FromSeconds(30), options.StableAfter);
|
|
Assert.Equal(TimeSpan.FromSeconds(5), options.HeartbeatInterval);
|
|
Assert.Equal(TimeSpan.FromSeconds(20), options.FailureDetectionThreshold);
|
|
Assert.Equal(2, options.MinNrOfMembers);
|
|
}
|
|
}
|